Senior Consultant - Cyber Resilience

Responsibilities

• Assess and mature incident response, cyber resilience, and threat intelligence capabilities. 

• Design or improve recovery operating models based on threat hunting scenarios, roles and responsibilities, escalation paths, and decision rights. 

• Develop and refine cyber recovery plans, recovery runbooks, crisis playbooks, and communications procedures. 

• Facilitate post-incident reviews, after-action reviews, and lessons-learned sessions that produce measurable improvements. 

• Create and conduct tabletop exercises, cyber recovery simulations, and technical recovery exercises. 

• Evaluate recovery dependencies across identity, networking, endpoints, applications, data, cloud platforms, backup infrastructure, and third parties. 

• Assess backup and restore strategies, including isolation, immutability, recoverability, privileged-access controls, and validation testing. 

• Help clients define critical attack paths, pertinent threat intelligence sources, and conduct exposure reconnaissance. 

• Create practical roadmaps to mature anticipation and recovery capabilities over time based on proven organizational threats. 

• Support implementation of prioritized improvements, coordinating with client technical teams and delivery partners. 

• Lead purple-team-style validation of cyber recovery readiness by translating realistic attack paths into scenarios that test prevention, detection, containment, response, and recovery. 

• Partner with offensive-security and defensive-security stakeholders to validate whether controls, telemetry, escalation paths, and recovery procedures work together. 

• Use threat intelligence, exposure findings, attack-path analysis, and detection gaps to prioritize resilience improvements. 

• Facilitate assume-breach exercises and adversary-emulation-informed tabletop exercises that produce actionable recovery requirements. 

• Use threat scenarios, exposure findings, and detection gaps to improve recovery readiness. 

• Identify control, telemetry, and detection improvements that would reduce time to contain, investigate, and recover. 

• Help clients connect vulnerability, exposure, detection, and recovery data into a risk-informed resilience program. 

• Contribute to assessments of compromise assumptions, blast radius, and recovery sequencing. 

• Provide feedback to upstream security capabilities based on incident and exercise findings. 

Consulting and practice responsibilities 

• Lead workshops with technical, operational, risk, and executive stakeholders. 

• Produce clear deliverables, including assessment reports, target-state designs, roadmaps, playbooks, exercise materials, and executive briefings. 

• Serve as a trusted advisor to clients during high-consequence resilience and recovery initiatives. 

• Contribute reusable methods, accelerators, reference architectures, and points of view to AHEAD’s cyber resilience practice. 

• Mentor consultants and collaborate with account, delivery, and technical leadership. 

• Support proposal development, scoping, estimation, and solution shaping for relevant engagements. 

Required Qualifications

• Significant experience in cybersecurity consulting, incident response, cyber recovery, disaster recovery, business continuity, or a closely related discipline. 

• Demonstrated experience designing, assessing, testing, or improving incident response and recovery capabilities. 

• Strong understanding of enterprise infrastructure and security environments, including identity, endpoints, networks, cloud, applications, data, backups, and third-party dependencies. 

• Ability to distinguish and integrate cyber recovery, IT disaster recovery, business continuity, and crisis management practices. 

• Experience facilitating tabletop exercises, simulations, post-incident reviews, or recovery testing. 

• Ability to communicate complex technical risks and recovery decisions to both practitioners and executives. 

• Strong consulting skills, including workshop facilitation, structured problem solving, written communication, and stakeholder management. 

• Willingness to travel for client engagements as required. 

Preferred Qualifications

• Experience with ransomware recovery, destructive attacks, identity compromise, cloud recovery, or major cyber incident response. 

• Experience developing recovery architectures, clean-room or isolated recovery environments, cyber vaults, immutable backups, or recovery validation programs. 

• Experience with security operations, detection engineering, threat hunting, threat intelligence, attack-path analysis, or exposure management. 

• Familiarity with NIST CSF, NIST SP 800-61, NIST SP 800-34, CISA guidance, ISO 22301, ISO 27001, or comparable frameworks. 

• Relevant certifications such as CISSP, CISM, CBCP, CRISC, GCIH, GCIA, GCFA, or equivalent experience. 

• Experience operating in regulated, complex, or highly available environments. 

• Experience building offerings, methodologies, or delivery practices in a consulting organization.